1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
use serde::{Deserialize, Serialize};
use serde_json::Value;
use time::OffsetDateTime;
use uuid::Uuid;
// ---------------------------------------------------------------------------
// Response types
// ---------------------------------------------------------------------------
/// A single tenant-scoped semantic audit log entry, returned by
/// `GET /api/v1/audit-logs`.
#[derive(Clone, Debug, Serialize, Deserialize)]
#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
pub struct AuditLogResponse {
/// Unique identifier of this audit log entry.
pub id: Uuid,
/// Actor type: `"user"`, `"api_token"`, `"oidc"`, `"service"`, `"system"`.
pub actor_type: String,
/// Optional actor identifier.
pub actor_id: Option<Uuid>,
/// Optional human-readable actor label.
pub actor_display: Option<String>,
/// Canonical semantic action identifier.
pub action_type: String,
/// Optional semantic target type.
pub target_type: Option<String>,
/// Optional semantic target id.
pub target_id: Option<String>,
/// Optional human-readable target label.
pub target_display: Option<String>,
/// Action outcome.
pub outcome: String,
/// Optional curated structured metadata payload.
pub details_json: Option<Value>,
/// Action kind: `"stateful"` (has before/after snapshots) or `"event"` (no state change).
pub action_kind: String,
/// State snapshot before the action (only present for `stateful` actions).
#[serde(default, skip_serializing_if = "Option::is_none")]
pub before_snapshot: Option<Value>,
/// State snapshot after the action (only present for `stateful` actions).
#[serde(default, skip_serializing_if = "Option::is_none")]
pub after_snapshot: Option<Value>,
/// Optional correlation UUID linking related audit entries.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub correlation_id: Option<Uuid>,
/// Optional request correlation id.
pub request_id: Option<String>,
/// Timestamp when the action occurred (RFC 3339).
#[serde(with = "time::serde::rfc3339")]
#[cfg_attr(feature = "openapi", schema(value_type = String, format = DateTime))]
pub occurred_at: OffsetDateTime,
}
/// A single system-level semantic audit log entry, returned by
/// `GET /api/v1/system-audit-logs`.
#[derive(Clone, Debug, Serialize, Deserialize)]
#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
pub struct SystemAuditLogResponse {
/// Unique identifier of this audit log entry.
pub id: Uuid,
/// Actor type: `"user"`, `"api_token"`, `"oidc"`, `"service"`, `"system"`.
pub actor_type: String,
/// Optional actor identifier.
pub actor_id: Option<Uuid>,
/// Optional human-readable actor label.
pub actor_display: Option<String>,
/// Canonical semantic action identifier.
pub action_type: String,
/// Optional semantic target type.
pub target_type: Option<String>,
/// Optional semantic target id.
pub target_id: Option<String>,
/// Optional human-readable target label.
pub target_display: Option<String>,
/// Action outcome.
pub outcome: String,
/// Optional curated structured metadata payload.
pub details_json: Option<Value>,
/// Action kind: `"stateful"` (has before/after snapshots) or `"event"` (no state change).
pub action_kind: String,
/// State snapshot before the action (only present for `stateful` actions).
#[serde(default, skip_serializing_if = "Option::is_none")]
pub before_snapshot: Option<Value>,
/// State snapshot after the action (only present for `stateful` actions).
#[serde(default, skip_serializing_if = "Option::is_none")]
pub after_snapshot: Option<Value>,
/// Optional correlation UUID linking related audit entries.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub correlation_id: Option<Uuid>,
/// Optional request correlation id.
pub request_id: Option<String>,
/// Timestamp when the action occurred (RFC 3339).
#[serde(with = "time::serde::rfc3339")]
#[cfg_attr(feature = "openapi", schema(value_type = String, format = DateTime))]
pub occurred_at: OffsetDateTime,
}
// ---------------------------------------------------------------------------
// Query parameters
// ---------------------------------------------------------------------------
/// Query parameters for listing audit log entries (tenant-scoped or system).
#[non_exhaustive]
#[derive(Clone, Debug, Default, Serialize, Deserialize)]
#[cfg_attr(feature = "openapi", derive(utoipa::IntoParams))]
pub struct AuditLogListParams {
/// Page number (1-based). Defaults to 1.
pub page: Option<u64>,
/// Items per page. Defaults to 20, max 1000.
pub per_page: Option<u64>,
/// Filter by actor type: `"user"`, `"api_token"`, `"oidc"`, `"service"`, `"system"`.
pub actor_type: Option<String>,
/// Filter by semantic action type.
pub action_type: Option<String>,
/// Filter by action outcome.
pub outcome: Option<String>,
/// Filter by semantic target type.
pub target_type: Option<String>,
/// Filter by semantic target id.
pub target_id: Option<String>,
/// Lower bound timestamp (inclusive), RFC 3339 format.
pub from: Option<String>,
/// Upper bound timestamp (inclusive), RFC 3339 format.
pub to: Option<String>,
/// Filter entries by a specific actor UUID.
pub actor_id: Option<Uuid>,
/// Filter entries by correlation UUID.
pub correlation_id: Option<Uuid>,
/// Filter by action kind: `"stateful"` or `"event"`.
pub action_kind: Option<String>,
}